Re: [pkix] RFC 5742 review of draft-hotz-kx509 and about RFC 4211

[[e-mail]]

First of all, thank you for both of you for your fast response.

I am not arguing there is an RFC 5742 conflict with this document.

Since you said that is an attempt to document an existing deployed 
protocol, we cannot change it.

Since you said that designing a better protocol is an expected follow-on 
work, I raise the question to both the editors and the WG chairs 
whether the document should be on the experimental track rather than on 
the informational track.

Clearly, I believe that only changes to the security consideration 
sections should be made, keeping in mind that 
confidentiality an integrity protection can be done at lower layers. This 
is what the security considerations section should recommend.

Finally, I believe an errata on RFC 4211 should be prepared, but this is a 
separate concern with Jim.

Denis



De :    Russ Allbery <[e-mail]>
A :     [e-mail]
Cc :    [e-mail], Jim Schaad <[e-mail]>, pkix 
<[e-mail]>
Date :  01/06/2012 07:20
Objet : Re: [pkix] RFC 5742 review of draft-hotz-kx509 and about RFC 4211



[e-mail] writes:

> I skimmed through the document and read the following two sentences:

>    The public key in the request is sent in the clear, and without any
>    guarantees that the requestor actually possesses the corresponding
>    private key.

>    [RFC4211], Appendix C contains a more detailed discussion of why 
>    proof-of-possession is important.

> I have concerns with both sentences.

> [RFC4211] is incorrect and this has security implications on the
> proposed protocol.

Hi Denis,

As Henry has mentioned, we have the limitation with this particular
document that we're attempting to document an existing, deployed protocol
sufficiently that interoperable implementations can be created.  This
protocol is deficient in multiple ways, and designing a better protocol is
expected follow-on work.  Changing something fundamental, such as
requiring confidentiality in this protocol exchange, would defeat the
point of the current work.

Therefore, I think that any remedy here should be limited to clearly
documenting the issue in the Security Considerations section rather than
changing the protocol.

If I'm understanding your message properly, you're saying that there is a
partial defense against the lack of proof-of-possession by adding
confidentiality protection to the exchange.  I'm not sure in this context
whether this really changes the security analysis of this protocol, given
that no confidentiality is used.  But if I'm missing something, could you
suggest something that we could add to Security Considerations?

-- 
Russ Allbery ([e-mail])             <http://www.eyrie.org/~eagle/>